npm/ep_etherpad-lite CVE-2026-55090: medium 5.3, EPSS 0.55%
Etherpad has stored XSS in HTML export via unescaped attribute-pool values
Action: Upgrade ep_etherpad-lite to 3.3.0 or later.
npm i ep_etherpad-lite@3.3.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.3.0 | - |
Fixed versions
| 3.3.0 |
Sources
- osv: GHSA-2jp7-wwpg-3p9w
- nvd: CVE-2026-55090
- https://github.com/ether/etherpad/security/advisories/GHSA-2jp7-wwpg-3p9w
- https://github.com/ether/etherpad/pull/7905
- https://github.com/ether/etherpad/commit/86c56cf827dd6e5ff1b6cd3760f87adc47f58bb1
- https://github.com/ether/etherpad
- https://github.com/ether/etherpad/releases/tag/3.3.0
CVE-2026-55090 · published · modified · JSON